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Resource Management Staff 


IHC/MM 80-2408 
26 March 1980 


STATINTL 


MEMORANDUM FOR: Director of Central Intelligence 

VIA: Deputy to the DCI for Resource Management 

FROM: | 

Director, Information Resources Office 
SUBJECT: Project SAFE 


STATINTL 


REFERENCE: 


A. 

B. 


Your memo of 21 March, Subject: Concern 
Regarding SAFE (Tab A) 


Memo from_ 
to DCI dtd 
Regarding SAFE 


Chairman, STAP 

18 Mar 1980, Subject: Questions 
(Tab B) 


1. I appreciate the opportunity to comment on the issues 
raised by the STAP Panel in connection with the SAFE Project. As 
background to our comments, I should point out that last year, 
after discussions between the D/DCI/RM, the DDCI, and DD A , it was 
determined that the focus of our interest in SAFE was to be "the 
areas of resource allocation and the relationship of SAFE to other 
programs on a Commun i ty -wi de basis."* Although we have continued 
to review the development of Project SAFE, our primary attention 
has been in accordance with the above quoted limitations. Conse- 
quently, we are not prep.ared to comment, except in general terms, 
on many of the concerns raised in the referenced STAP memorandum. 

2. Of the four principal concerns listed in your memo of 
March 21st, only one falls within the scope of IRO's responsi- 
bility as set forth in paragraph 1 above, namely: 

"What actions are underway to ensure that the Intelli- 
gence Community has access to CIA SAFE and that CIA SAFE 
has access to DIA SAFE as well as such systems as COINS 
and SOLIS?" 


*Memo from DDCI. to D/DCI/RM dated 16 March 1979 , Subject: Project 
SAFE 
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3. It is appropriate that your concerns along these lines 
be addressed because: 

o At the DCI's semiannual review in May 1979, it was 
stated that a direct physical link between the DIA 
and CIA systems would be provided. 

o Our review of the current version of the System 
Requirements Specifications indicates that such a 
communications connection between CIA and DIA SAFE 
systems is not included in the specifications. 

o I have discussed this deficiency to the attenticin of 
the SAFE Project Manager and he states that such a 
requirement will be added by amendment; that, 
although this has not yet been accomplished, such an 
amendment will be prepared in the near future. 

4. We believe that it is crucial to the ultimate development 
of the types of intercommunication which are set out in your 
subject memorandum that this requirement be now formalized in the 
SAFE documentation since, if properly specified, it will provide 
the technical capability to enable: 

o CIAanalysts to access DIA files. 

o CIA analysts to access other Community files 
through the DIA SAFE interface with the COINS 
network which is included in the current 
requirements documents. 

o DIA analysts to access CIA SAFE files. 

o Analyst to analyst communications between DIA 
and CIA analysts. 

o The capability to permit other Intelligence 

Community components to access CIA SAFE facilities 
by going through the DIA interfaces with the COINS 
or AUTODIN networks. 

5. It should be noted that the provision of the physical 
links and the technical capabilities to accomplish the above 
listed functions will not, in and of itself, result in the 
implementation of any of these functions. None of the SAFE 
documentation, either emanating from DIA or CIA, calls for these 
functions to be provided. Indeed, the original CIA SAFE docu- 
mentation specifically provides that the CIA SAFE system will be a 
closed system accessible only by CIA personnel. The position has 
been taken by some that CIA has no validated requirement for 
access to any non-CIA system, including DIA SAFE. The results of 
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the IHC-sponsored Analyst Support Study indicate that this is 
probably not the case. Nearly half of the CIA analysts 
interyiewed said they regularly access outside data bases such as 
SOLIS, the COINS files, CIRC II, and the NPIC data system. 
Furthermore, ana 1 y s t - to -ana 1 y s t communication across agency lines 
was ranked the second most important source of information by CIA 
analysts and the most important source by DIA analysts. As 
automated systems develop and improve and analysts become 
increasingly confident in their use of and reliance upon direct 
access to automated systems, requ i remen ts for and the value of 
access to external systems should increase still further. 


6. The management of the Consolidated SAFE Project Office is 
working under a handicap in this area. There has been, to our 
knowledge, no extensive formal review or update of CIA's 
functional requirements on the user side since the decision was 
made to combine the two programs. Without any formal statement of 
requirements from the CIA analytical community (primarily NFAC) 
which the systemis designed to support, it is difficult for those 
charged with designing and implementing the system to anticipate 
what those needs may be. Therefore, we suggest that either you or 
some other appropriate authority should give to the SAFE Project 

Office some appropriate guidance which addresses these areas of 
concern . 


7 * We w °uld call to your attention the fact that providing 
any access to the CIA system from DIA and more especially from 
elements of the Intelligence Community outside of DIA raises 
serious security issues. The resolution of these issues will 
probably require action on your part to modify the present 
interpretation of existing security policies, or in some cases 
amendments thereto. If you should decide that the combined SAFE 
systems should provide the types of intercommunication and outside 
access which are outlined in your areas of concern, then someone 
(possibly the Computer Security Subcommittee of the DCI Security 
Committee) should probably be tasked with the responsibility of 
defining the security issues, suggesting possible solutions, and 
performing appropriate risk analyses so that they may be submitted 
to you for resolution. If this is undertaken, I RO should probably 
be involved in someway since decisions on these issues will* 
undoubtedly have major long-term effects on the feasibility of 
improving the interagency exchange of information and could also 
have a substantial impact on the resources which will be needed to 
satisfy Community ADP requirements. 

8. General comments on other concerns expressed by you based 
upon our limited perspective are: 


3 
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We are informed that 

the CIA user interf ace wi th fTTe" 


of OCR is coordinating 
CSPO; that he is 


completely aware of the status of the project and 
consults regularly with the CSPO. 


o In the development of a project such as SAFE, it is 
extremely important that a well defined single point 
of contact between the users and developers be 
established and maintained. Otherwise, the system 
developers will be faced with conflicting statements 
of requ i rements . 

o If, in fact, the established lines of communications 
with the users are not adequate, perhaps the reason 
is attributable to a lack of an effective framework 
within NFAC to provide a continuing review of SAFE 
as it develops. If this is the case, we are not aware 
of it. 


o We see no evidence that "major portions of the 

proposed operational capabilities are unspecified." 

It is, however, probably true that NFAC should direct 
more attention to the general issue of what its 
requirements for open source material are and how 
these should be met, either through SAFE or other 
means . 

o The decision to place SAFE on a design-to-cost basis 
necessarily implied some scaling down of the original 
requirements for the initial version. In consonance 
with this, NFAC did review and set priorities on the 
original SAFE requi rements . 

o It is our assessment that the CSPO is proceeding with 
development so that NFAC's highest priorities will be 
met first and the design will accommodate the later 
addition of those functions which now enjoy a lesser 
p r i o r i ty . 

o If some of the capabilities which this approach will 
require to be deferred are considered to be important 
enough to warrant it, NFAC should develop a justifi- 
cation for their inclusion in the initial version of 
SAFE and the issue should be addressed during program 
review. 

9. In conclusion, I would take this opportunity to inform 
you of two initiatives we are taking in conjunction with the IHC 
which may have an impact on the future development of SAFE. 
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o The development of a user language for SAFE will 
result in a common user language for DIA & CIA. 

We are exploring the possibility that this could 
become the initial step for developing user language 
standards for use throughout the Community. This will 
require the cooperation of the SAFE Project Office 
if it is to succeed. 

o We expect the IHC to recommend the development 
of a distributed system of bibliographic informa- 
tion storage and retrieval systems. If this is 
to be done, the facilities of both the DIA & CIA 
SAFE systems in this area will have to function 
as part of an overall Community system. If this 
is to be accomplished, the interconnection of 
the two systems could taken on added importance. 


7 


STATINTL 
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21 March 1980 


MEMORANDUM FOR: Deputy Director for National Foreign Assessment 
Deputy Director for Administration 
Director of Data Processing 

FROM: Director of Central Intelligence 

SU3JECT: Concerns Regarding SAFE 


1. One of the subjects addressed at the recent Science and 
Technology Advisory Panel (STAP) meeting was the SAFE system and 
its implementation. Several concerns were expressed at the meeting 
regarding SAFE, incl uding the fact that there are no plans at present 
to connect CIA and DIA SAFE systems so that they are mutually accessible. 
I share several of the concerns expressed by the Science and Technology 
Advisory Panel, and accordingly would like to meet with you to address 
several of the issues that were raised by the Panel. I attach for your 
information and response a list of questions and concerns prepared by. 
the STAP relating to SAFE. While I would appreciate your' being prepared 
to address all of these questions at our meeting, I personally am 
especially concerned about the following: 

-- What actions are under way to' ensure that the Intelligence 
Community has access to CIA SAFE and that CIA SAFE has access to 
DIA SAFE as well as such systems as COINS and SOLIS? 

-- How will SAFE deal with open source material? 

— As described in some detail on page 3 of the STAP paper, 
what actions are being taken to identify the real needs of the 
SAFE user community and will they be satisfied by the system? 

-- How can CIA make a reasonable evaluation of the current 
status of SAFE with major portions of the proposed operational 
capabilities either unspecified or not communicated to the 
Agency? ' • 
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2. I will schedule a meeting to discuss these issues toward the 
end of next week. In the meantime, I would appreciate your responding 
to all of the questions in the attached paper and providing such responses 
to me by the middle of next week for my' use in preparation for the meeting. 


STANSFIELD TURNER 


Attachment a/s 

cc: DDCI 
DDS&T 
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DIRECTOR OP CENTRAL INTELLIGENCE 
Science and Technology Advisory Panel 




STATINTL 


1 8 MAR 1930 


MEMORANDUM FOR: 


FROM: 


Director of Central Intelligence 
Deputy Director of Central Intelligence 


STAP Chairman 


SUBJECT 


Questions Regarding SAFE 


1. In response to your request of March 14, 1980, 
for comments on the current status of SAFE, I attach a 
list of eight questions and brief comments that STAP 
believes should be addressed. 


■■2. STAP is continuing its analysis of the SAFE 
problem and will prepare an options paper within the next 
two weeks for your consideration. 


Attachments : 
As Stated 



STATINTL 
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1.0 What steps are being taken to ensure that the Agency, 
rather than the contractor is in control of the technical 
aspects of the design of the system? 

The geographic remoteness of the contractor, and the 
lack of continuing contractor-user interaction can lead to 
a situation in which the builder of the system also becomes 
the architect. The absence of reciprocal technical 
representation, like resident engineers, delays every 
routine decision and makes larger ones unresponsive to/ 
Agency/community needs or technological constraints. Strong 
Agency technical management is absolutely essential if the 
system is to satisfy real and evolving agency needs and if 
it is to be integrated with other Agency and community 
resources . 


2.0 How is SAFE management ensuring that a final working 
system has been developed from the continuing evolution of 
an operationally valid pilot system? How has SAFE taken 
advantage of the experience of similar, very large systems 
in their: 

1) system architecture, 

2) communication and control, and 

3) changing performance requirements? 

How is SAFE management ensuring that the system will: 

1) make available data on operation and usage of the 
pilot system to guide development; 

2) be able to modify both system functions and 
interaction capabilities so as to meet changing and evolving 
requirements ; and 

3) be able to add new functions and interactions so as 
to meet new requirements? 

Relevant Experience -- It is well agreed that an' 
information handling system cannot be achieved by a simple. 
Des.ign-Build-Use cycle, no matter how brillant the design 
or faithful the building. Consider three (out of many) 
currently operating very large nets with requirements at 
least comparable in size and complexity with the Agency/ 
community's: 

1) the ARPA net, 

2) the airlines reservation system, and 

3) the IBM in-house computing net. 
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All of these systems evolve d - that is, they started 
as soon as possible with operating pilot systems, so that 
there was always an operational evaluation of effectiveness. 

urthermore, in each case, a primary purpose of the original 
plans was drastically altered as experience was gained. Even 
so, developments in concept, hardware, software, and practice 
are continuing now in greater volume than ever. 


2.1 The ARP A .Net 

l i he ARPA net was originally conceived by Larry Roberts 

at the ARPA IPO (Information Processing Office) as a means" 
of netring research computers in order to do distributed 
computing. The message facility was then a minor function 
As message usage rose, packet switching became a powerful 
tool with wide application elsewhere in the technology. The 
separate centers in the ARPA net have much independence, 
subjecu to some fairly strict requirements for communications 
protocols and access. This allows competitive development 
and a common evaluation of new technological developments - 
e.g.,. the intelligent terminal is being subjected to widespread 
experimentation and development. 


2.2 Airlines Reservation System 

^ ihs first automated electronic airfare reservations and 
ticketing systems were disasters ~ e.g., SABER, the 
American Airlines/IBM effort was predesigned and built to 
an apparently reasonable set of specifications that turned 
out not at all to match the operational needs. The first 
successful ones were ad hoc temporary devices (e.g., UNITED) 
worked just well enough to be improved. 

Note that the requirement for fast and accurate inter— 
line communications , backed up by automatic commitments’ for 
seam and equipment was a much later development; it is, however, 
by now one of the most valuable and cost-effective facilities. 


2 . 3 The IBM In-House Computing Net 

Virtually all the on-line . computers at IBM company 
ms Lilxations world— wide are netted together by communication 


- 2 - 
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facilities, making them, we believe, the largest net ii 

the world. Admirable new functions exhibited by their 
systems are: 


1) a modifiable macro command language 
translitionoh^' transmission/ 


3.0 The SAfE user community consists of Intelligence.-' 
Community analysts covering the full spectrum of research 
into foreign political, military, economic, scientific 
and tecnnological activity. Their effective use of this 
system and, ultimately, the quality of intelligence thev 
produce rest on whether their real needs can be identifie< 

Sill^^f i 8d thG SystGm * To that ^d, what actions 
will be taken to ensure that: 


1) all elements of the intended user community 
are actually involved in the system's continuing development. 


are ° f "" PreSent requirements 


consisieS e m!thoir nt requirGments can validated by a 


4) the validated present requirements will be met. 


as -b tl nSW re< 3 uiremen ts can be accepted’ 

c.s Lney are identified. 


skillQ dJV an ^ ytl ? al V sers Wl11 acquire the necessary 
sxxUs^and familiarization with SAFE on an interim basis so 

reached 6 ready t0 begin broad utilization when system IOC is 


7) this interim SAFE test-phase acquires continuing. 
comprehensive experimental data on user experience with the 
system, and ^ UUfc - 


. . , 8 ^ tbe acquired data on user experience is actually 
uuilized m the architecture and development of the system? 
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4 . 0 How can the Agency make a reasonable evaluation of the 
current status of . SAFE with major portions of the proposed 

tn^h^a 51 * 1 C ^ pa ^ ilities either unspecified or uncommunicated 
to the Agency? For example, 

1) the user command language and its parsing, 

2) the user programming languages, 

3) the user editing languages, and 

, . 4 \ Procedures for backup, including regeneration 'of 

derived files lost in crashes. 

Note the above have to be prototypes capable of continuing 
responsive evolution, rather thaS" final imposed prescriptions. 5 


5.0 What actions are under way to insure that the Intelligence 

aCC ?? S t0 CIA SAFE and that CIA SAFE has access 
to DIA SAFE as well as such systems as COINS and SOLIS? 

The absence of appropriate linkages with other IC systems 
makes it highly probable that duplicate facilities and files 
wHl be acquired and constructed with higher costs and lessened 
capability for the total IC system. Provisions for such 


linkages should ^ be built into SAFE from, the start, othe 

it will be difficult if not impossible to backfit these 
linkages * 


otherwise 


6,0 How will SAFE deal with open source material? Will 

material, either finished publications or field reporting 

be made available to the analyst through SAFE? How will SAFE 
deal with current newspaper and journal entries? 

Several of the offices that will use SAFE, in particular 
OPA and OSWR, make extensive use of open source material. 
Their analytical efforts will be seriously hampered if* their 
files do not include open source materials. 

7.0^ Wnat steps are being taken to ensure that SAFE will be 
designed to allow collaborative usage? 

Examination of other similar systems, such as Stanford 
University’s SUMEX system or the internal IBM system, shows 
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that user-to-user interactions comprise a significant 
fraction of the total use of these systems and greatly 
enhance the overall analytical capability of its users. 

0.0 What steps are under way to ensure that in the 
procurement of major hardware items, these items will be 
compatible with existing Agency systems? 

The Agency has made very substantial investment in 
ADP equipment that currently serves a wide variety of 
users. This investment should be capitalized on in order 
to enhance the future capabilities and particularly the 
flexibility of SAFE. If the interoperability of SAFE and 
existing ODP hardware is. going to be dependent on software, 
then provisions should be made: 

.1) for the development of the needed software since 
it will be a major undertaking; and 

2) for the establishment of evolving standards and 
protocols for interconnection. 


1 

1 

I 
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